4.x Header set in SE-style filter is cleared by JAX-RS handling

[tjquinno]

Environment Details

• Helidon Version: 4.x
• Helidon SE or Helidon MP MP
• JDK version:
• OS:
• Docker version (if applicable):

---

Problem Description

In an MP app, response headers set in an SE-style filter (that is, not a Jakarta REST filter) are lost when JaxRsService attempts to handle the request and cannot. It resets the routing which includes clearing the headers.

Steps to reproduce

1. Add the files below to the Helidon MP QuickStart project.

2. Build the project.

3. Run the project with the debugger, setting breakpoints:

   1. In the lambda very near the bottom of the new Java class below.
   2. At the code linked to above--JaxRsService#doHandle around line 251; the service has discovered that Jersey did not handle the request and it invokes routing.reset() which, among other things, clears the headers.

4. Access http://localhost:8080/health.

   Helidon invokes the filter which sets the headers.

   But JaxRsService clears those headers.

---

Files to add:

Add the following services file io.helidon.webserver.spi.ServerFeatureProvider to src/main/resources/META-INF/services

io.helidon.examples.quickstart.mp.HeaderAdjustmentFeatureProvider

Add this config snippet to application.yaml:

server:
  features:
    header-adjustment:

(There might be a way to auto-load the feature without adding config to trigger it but I didn't spend much time looking for one.)

Add this class to the MP QuickStart project:

/*
 * Copyright (c) 2025 Oracle and/or its affiliates.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package io.helidon.examples.quickstart.mp;

import io.helidon.common.Weight;
import io.helidon.config.Config;
import io.helidon.http.Header;
import io.helidon.http.HeaderValues;
import io.helidon.webserver.WebServer;
import io.helidon.webserver.http.HttpFeature;
import io.helidon.webserver.http.HttpRouting;
import io.helidon.webserver.observe.health.HealthObserverConfig;
import io.helidon.webserver.spi.ServerFeature;
import io.helidon.webserver.spi.ServerFeatureProvider;

/**
 * Server feature to insert headers for selected responses.
 */
@Weight(HeaderAdjustmentFeatureProvider.WEIGHT)
public class HeaderAdjustmentFeatureProvider
        implements ServerFeatureProvider<HeaderAdjustmentFeatureProvider.HeaderAdjustmentFeature> {

    static final double WEIGHT = 90D;

    @Override
    public String configKey() {
        return "header-adjustment";
    }

    @Override
    public HeaderAdjustmentFeature create(io.helidon.common.config.Config config, String name) {
        return new HeaderAdjustmentFeature();
    }

    @Weight(WEIGHT)
    public static class HeaderAdjustmentFeature implements ServerFeature {

        private static final Header X_CONTENT_TYPE_OPTIONS_NO_SNIFF = HeaderValues.create("X-Content-Type-Options", "nosniff");

        public HeaderAdjustmentFeature() {
        }

        @Override
        public void setup(ServerFeatureContext serverFeatureContext) {
            serverFeatureContext.socket(WebServer.DEFAULT_SOCKET_NAME)
                    .httpRouting()
                    .addFeature(new HeaderAdjustmentHttpFeature(Config.global()));
        }

        @Override
        public String name() {
            return "header-adjustment";
        }

        @Override
        public String type() {
            return "header-adjustment";
        }

        @Weight(WEIGHT)
        private static class HeaderAdjustmentHttpFeature implements HttpFeature {

            private final io.helidon.common.config.Config config;

            private HeaderAdjustmentHttpFeature(io.helidon.common.config.Config config) {
                this.config = config;
            }

            @Override
            public void setup(HttpRouting.Builder builder) {

                HealthObserverConfig healthObserverConfig =
                        HealthObserverConfig.create(config.root().get("server.features.observe.observers.health"));
                builder.addFilter((chain, req, resp) -> {
                    if (req.path().path().endsWith(healthObserverConfig.endpoint())) {
                        resp.header(HeaderValues.CACHE_NO_CACHE); // Helidon will do this itself after an upcoming PR.
                        resp.header(X_CONTENT_TYPE_OPTIONS_NO_SNIFF);
                    }
                    chain.proceed();
                });
            }
        }
    }
}